Question 1

What are the three types of data that indexes contain in Splunk Cloud?

Options :

A : Raw data, index data, and metadata

B : Raw data, event data, and metadata

C : Raw data, index data, and metrics data

D : Raw data, index data, and event data

Answer: A

Question 2

Which of the following is a valid stanza in props. conf?

Options :

A : [sourcetype::linux_secure]

B : [host=nyc25]

C : [host::nyc*]

D : [host:nyc*]

Answer: A

Question 3

What is the main advantage of managed Splunk Cloud over self-service Splunk Cloud in terms of scalability and reliability?

Options :

A : Managed Splunk Cloud provides a single-instance environment that can scale up to 10TB/day and offers a 100% uptime SLA.

B : Managed Splunk Cloud provides a clustered environment that can scale up to 5TB/day and offers a 99.9% uptime SLA.

C : Managed Splunk Cloud provides a clustered environment that can scale up to 10TB/day and offers a 100% uptime SLA.

D : Managed Splunk Cloud provides a single-instance environment that can scale up to 5TB/day and offers a 99.9% uptime SLA

Answer: C

Question 4

Which type of metadata can be used to identify the origin of the data?

Options :

A : Index

B : Sourcetype

C : Source

D : Host

Answer: D

Question 5

The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

Options :

A : The value of the TZattribute in props. cont for the a :ces3_ccwbined sourcetype.

B : The value of the TZ attribute in props, conf for the my.webserver.example host.

C : The time zone of the Heavy/Intermediate Forwarder with the monitor input.

D : The time zone indicator in the raw event data.

Answer: D